Virus javanet [Résolu]

Bon je vais le poster puisqu'il y a personne qui repond ^^"
Logfile of HijackThis v1.99.1
Scan saved at 14:48:34, on 22/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Yaman\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe javanet.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,javanet.exe
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\NVC\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Winamp Agent] C:\WINDOWS\System32\winamp.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton AntiVirus\SAVScan.exe (file missing)

voila

bonjour
Télécharger : en anglais gratuit 30 jours
Ewido security suite

le mettre à jour = update now
-------
Redémarre en mode Sans Échec
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes. Relancer le Pc et tapoter la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionner Mode sans échec ==> entrée ==>nom utilisateur habituel
---
Scanner puis Complete System Scan ( c’est assez long) et Supprimer ce qu’il trouve = Apply all actions
clic Save Report puis Save report as l’enregistrer sur le bureau

---------
relancer hijack
cocher et fix checked

F2 - REG:system.ini: Shell=Explorer.exe javanet.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,javanet.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll (file missing)
O4 - HKLM\..\RunServices: [MS Java for Windows XP & NT] javanet.exe
O4 - HKCU\..\RunServices: [MS Java for Windows XP & NT] javanet.exe

-----
et en ayant accés aux fichiers cachés
Démarrer =>Poste de travail =>Outils =>Options des dossiers =>Affichage
Cocher = Afficher les fichiers et dossiers cachés
Plus bas
Décocher =Masquer les extensions des fichiers dont le type est connu
Décocher =Masquer les fichiers protégés du système d'exploitation


supprimer ( si présent)
userinit.exe,javanet.exe ==> dans C:\WINDOWS\System32 /!\ pas userinit.exe

----
redémarrer en mode normal
refaire un hijack et mettre le rapport dans la réponse + celui de Ewido
------

tu devrais mettre le SP2 de windows
SP2

Dsl pour le retard ^^"

Alors sa c'est Hijackthis :
Logfile of HijackThis v1.99.1
Scan saved at 17:12:43, on 22/08/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Documents and Settings\Yaman\Mes documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\NVC\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Winamp Agent] C:\WINDOWS\System32\winamp.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton AntiVirus\SAVScan.exe (file missing)

et sa c Ewido :
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 17:06:44 22/08/2006

+ Scan result:



C:\WINDOWS\system32\tlva.exe -> Backdoor.PoeBot.c : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@2o7[2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@adtech[2].txt -> TrackingCookie.Adtech : No action taken.
:mozilla.48:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@atdmt[1].txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.32:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@bluestreak[2].txt -> TrackingCookie.Bluestreak : No action taken.
:mozilla.31:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.54:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.9:C:\Documents and Settings\Yaman\Application Data\Mozilla\Profiles\default\zvprk7g8.slt\cookies.txt -> TrackingCookie.Googleadservices : No action taken.
:mozilla.22:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.41:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.42:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.43:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.44:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.10:C:\Documents and Settings\Yaman\Application Data\Mozilla\Profiles\default\zvprk7g8.slt\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.13:C:\Documents and Settings\Yaman\Application Data\Mozilla\Profiles\default\zvprk7g8.slt\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.14:C:\Documents and Settings\Yaman\Application Data\Mozilla\Profiles\default\zvprk7g8.slt\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.17:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.19:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.20:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : No action taken.
:mozilla.47:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.11:C:\Documents and Settings\Yaman\Application Data\Mozilla\Profiles\default\zvprk7g8.slt\cookies.txt -> TrackingCookie.Weborama : No action taken.
:mozilla.12:C:\Documents and Settings\Yaman\Application Data\Mozilla\Profiles\default\zvprk7g8.slt\cookies.txt -> TrackingCookie.Weborama : No action taken.
:mozilla.24:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Weborama : No action taken.
C:\Documents and Settings\Yaman\Cookies\yaman@weborama[1].txt -> TrackingCookie.Weborama : No action taken.
:mozilla.46:C:\Documents and Settings\Yaman\Application Data\Mozilla\Firefox\Profiles\0r3ecnza.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.


::Report end

Le message d'erreur n'apparait plus.
Sa y es mon ordi va bien ?

Ok merci pour ton aide